Publish cosign signatures for release OCI images

## Context

PR #121 documents that GitHub Release assets are published with SHA256 checksums and keyless cosign signatures. OCI image signatures are still intentionally listed as future work.

## Scope

- Identify the OCI images and immutable digests that are published by the release workflow.
- Extend the release workflow to sign published image digests with keyless cosign after image publication.
- Document the expected certificate identity, issuer, and verification command in `release/VERIFY.md`.
- Update the public security self-assessment and product security-assurance docs once image signatures are actually published.

## Done when

- A new public release publishes verifiable cosign signatures for release image digests.
- `release/VERIFY.md` includes a copy/paste verification flow for those images.
- The docs no longer need to list OCI image signatures as a gap.

## Non-goals

- Do not document private registry access, deployment credentials, or non-public release evidence.

Start by inspecting the release workflow to identify the OCI images and immutable digests it publishes, then review release/VERIFY.md and the public security self-assessment and product security-assurance docs. Extend the release process for keyless cosign signing and document the certificate identity, issuer, and verification command. Done means a public release has verifiable image signatures and the docs no longer list them as a gap.

Written by the indexing model from the issue text.